MENU
After studying the following log entries, how many user IDs can you identify that the attacker has tampered with?
1. mkdir -p /etc/X11/applnk/Internet/.etc
2. mkdir -p /etc/X11/applnk/Internet/.etcpasswd
3. touch -acmr /etc/passwd /etc/X11/applnk/Internet/.etcpasswd
4. touch -acmr /etc /etc/X11/applnk/Internet/.etc
5. passwd nobody -d
6. /usr/sbin/adduser dns -d/bin -u 0 -g 0 -s/bin/bash
7. passwd dns -d
8. touch -acmr /etc/X11/applnk/Internet/.etcpasswd /etc/passwd
9. touch -acmr /etc/X11/applnk/Internet/.etc /etc
Suggested Answer: C
Get Premium CPEH-001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Passwd is the command used to modify a user password and it has been used together with the usernames nobody and dns.
15 comments · newest first
LE
Levi
12 months ago
I think it's just 'nobody' and 'dns' for sure.
DA
Dana
12 months ago
'acmr' is also mentioned, but not sure if it's tampered.
TA
Tasia
1 year ago
Wait, are we sure about 'IUSR_'? Seems sketchy.
CL
Claudia
1 year ago
Totally agree, those are the obvious ones!
TH
Thurman
1 year ago
Looks like the attacker messed with 'nobody' and 'dns'.
JE
Jesusa
1 year ago
I'm a bit confused about the entries. The "passwd" commands seem suspicious, but I can't recall if they indicate tampering directly.
DO
Domonique
1 year ago
I remember a practice question where we had to identify user IDs too. I feel like "nobody" and "dns" are definitely involved here.
ME
Meaghan
1 year ago
I think the attacker tampered with the user IDs "nobody" and "dns," but I'm not entirely sure about "IUSR_."
LE
Lea
1 year ago
I think "nobody" and "dns" are the right answers, but I wonder if "IUSR_" could be a trick option.
YE
Yen
1 year ago
I'm a little confused by the wording of the question. Is it asking about the overall category these security measures fall under? I'll need to re-read the options carefully.
QU
Queen
1 year ago
This is a good test of my understanding of BPEL. I'm feeling confident I can work through the possible statements and identify the one that is true.
KE
Kerrie
1 year ago
Hmm, I'm a bit confused by the options. I'm not sure if the Cisco FastLocate technology or the device Bluetooth via the app would be better solutions. I'll need to review the details more carefully.
AR
Armando
1 year ago
I think I've got a solid strategy here. I'll carefully consider each option and try to identify the 3 that are targeting the OS.
CL
Claudia
1 year ago
Hmm, I'm a bit unsure about this one. Is a workflow the only way to send an email notification on a process completion? I'm wondering if an action step or a Power Automate flow step could also work. I'll need to think this through carefully.
ST
Stephane
1 year ago
This seems straightforward to me. Since Dale had to give the $1,000 to her employer, it should just be deducted from her taxable income. I'm going with C.